Comment on Fake ‘One Battle After Another’ torrent hides malware in subtitles

someguy3@lemmy.world ⁨2⁩ ⁨days⁩ ago

When the CD shortcut is executed, it launches Windows commands that extract and run a malicious PowerShell script embedded in the subtitle file between lines 100 and 103.

This PowerShell script will then extract numerous AES-encrypted data blocks from the subtitles file again to reconstruct five PowerShell scripts that are dropped to ‘C:\Users<USER>\AppData\Local\Microsoft\Diagnostics.’

The extracted PowerShell scripts act as a malware dropper, performing the following actions on the host:

…

source
Sort:hotnewtop